Bug 877908 - pool permissions have no effect
pool permissions have no effect
Product: Virtualization Tools
Classification: Community
Component: libvirt (Show other bugs)
Unspecified Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: Libvirt Maintainers
Depends On:
  Show dependency treegraph
Reported: 2012-11-19 03:49 EST by Kamil Páral
Modified: 2016-04-26 10:42 EDT (History)
13 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2015-04-27 17:07:37 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Kamil Páral 2012-11-19 03:49:33 EST
Description of problem:
I have adjusted the permissions of my default libvirt pool to 0777 1000:1000.

# virsh pool-dumpxml default
<pool type='dir'>
  <capacity unit='bytes'>179672104960</capacity>
  <allocation unit='bytes'>110910464000</allocation>
  <available unit='bytes'>68761640960</available>

But when I create a new volume in that pool, it has 0700 0:0 :
# virsh vol-create-as default abc 100M
Vol abc created

# ll /var/lib/libvirt/images/abc 
-rw------- 1 root root 104857600 Nov 19 09:34 /var/lib/libvirt/images/abc

That doesn't seem to match the documentation:
    Provides information about the default permissions to use when creating volumes. This is currently only useful for directory or filesystem based pools, where the volumes allocated are simple files. For pools where the volumes are device nodes, the hotplug scripts determine permissions. It contains 4 child elements. The mode element contains the octal permission set. The owner element contains the numeric user ID. The group element contains the numeric group ID. The label element contains the MAC (eg SELinux) label string. Since 0.4.1 

Version-Release number of selected component (if applicable):

How reproducible:
Comment 1 Fedora End Of Life 2013-07-03 19:45:18 EDT
This message is a reminder that Fedora 17 is nearing its end of life.
Approximately 4 (four) weeks from now Fedora will stop maintaining
and issuing updates for Fedora 17. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '17'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 17's end of life.

Bug Reporter:  Thank you for reporting this issue and we are sorry that 
we may not be able to fix it before Fedora 17 is end of life. If you 
would still like  to see this bug fixed and are able to reproduce it 
against a later version  of Fedora, you are encouraged  change the 
'version' to a later Fedora version prior to Fedora 17's end of life.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.
Comment 2 Cole Robinson 2015-04-27 17:07:37 EDT
Libvirt does support changing pool permissions, but you have to define the new XML, then do a 'pool-build'. pool-build is the command for any potentially destructive pool operations.
Comment 3 Cole Robinson 2015-04-27 17:08:18 EDT
And to be clear I believe libvirt has supported this for a number of years so it should be in all supported libvirt versions
Comment 4 Kamil Páral 2015-05-12 06:59:17 EDT
I have created a new pool 'test' on /test with 1000:1000 777 permissions and ran virsh pool-build test. That correctly created the dir. But if I create a new volume from virt-manager or using vol-create, it is still created with root:root 600 permissions. What am I doing wrong?

$ virsh pool-dumpxml test
<pool type='dir'>
  <capacity unit='bytes'>117028003840</capacity>
  <allocation unit='bytes'>62224330752</allocation>
  <available unit='bytes'>54803673088</available>

$ ll -d /test
drwxrwxrwx. 2 kparal kparal 4.1k May 12 12:46 /test

$ ll /test
total 340k
-rw-------. 1 root root 1.1G May 12 12:46 zzz.qcow2

Comment 5 Ján Tomko 2015-05-12 08:03:25 EDT
The permissions in the <pool> XML are the permissions of the directory:
The permissions in the <volume> XML are the permissions of the volume:
Comment 6 Kamil Páral 2015-05-12 09:47:08 EDT
Oh, I see, I cited the documentation for volumes and assumed it's meant for pools. Sorry for confusion.

So, is there any way to define a default volume permissions globally, so that it's applied for any new volume created from virt-manager? Thanks for help.
Comment 7 Cole Robinson 2015-05-19 10:51:55 EDT
(In reply to Kamil Páral from comment #6)
> So, is there any way to define a default volume permissions globally, so
> that it's applied for any new volume created from virt-manager? Thanks for
> help.

No there isn't any way currently. The rule is basically:

1) If permissions specified in the XML, use those (at 'build' time for pools, create time for volumes)
2) If no perms specified when building a new directory, use 755
3) If no perms specified when building a new volume, use 600

Note You need to log in before you can comment on or make changes to this bug.